Re: openssh-3.4p1.tar.gz trojaned

From: Przemyslaw Frasunek (venglinat_private)
Date: Mon Aug 05 2002 - 02:37:24 PDT

  • Next message: Ken Grossman: "RE: Scanning Port UDP 4668"

    Edwin Groothuis <edwinat_private> napisał(a):
    
    > Just want to inform you that the OpenSSH package op ftp.openbsd.org
    > (and probably all its mirrors now) it trojaned:
    
    Actually, it's possible, that also other machines at openbsd.org were
    compromised (dns servers? cvs.openbsd.org?). Recently we had complains
    about some malicious IRC activity originating from cvs.openbsd.org,
    which was possibly cracked or DNS spoofed. 
    
    03:11 EFNet:[ Whois deraadt (deraadtat_private)
    03:11 EFNet::    Ircname : Theo de Raadt
    03:11 EFNet::     Server : irc.efnet.pl [ATMAN Network, Warsaw, Poland ]
    03:11 EFNet::       Idle : 0 days 0 hours 1 mins 9 secs
    03:11 EFNet::     Signon : Fri Aug  2 03:09:58 2002
    03:10 EFNet:- irc.efnet.pl - *** Notice -- User deraadt
                     (deraadtat_private) is attempting to join locally
                     juped channel #phrack
    
    -- 
    * Fido: 2:480/124 ** WWW: http://www.frasunek.com/ ** NIC-HDL: PMF9-RIPE *
    * Inet: przemyslawat_private ** PGP: D48684904685DF43EA93AFA13BE170BF *
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Mon Aug 05 2002 - 13:35:54 PDT